Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Minor documentation updates to docs/WASI-tutorial.md #6839

Merged
merged 2 commits into from
Aug 14, 2023
Merged

Minor documentation updates to docs/WASI-tutorial.md #6839

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2ad6b0e
Docs: Remove unneeded command in WASI-tutorial.md
JiaT75 Aug 11, 2023
cda80c6
Docs: Update error messages in WASI-tutorial.md.
JiaT75 Aug 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 4 additions & 5 deletions docs/WASI-tutorial.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -182,7 +182,7 @@ Ok, this program needs some command-line arguments. So let's give it some:
```
$ echo hello world > test.txt
$ wasmtime demo.wasm test.txt /tmp/somewhere.txt
error opening input test.txt: failed to find a pre-opened file descriptor through which "test.txt" could be opened
error opening input test.txt: No such file or directory
```

Aha, now we're seeing the sandboxing in action. This program is attempting to
Expand Down Expand Up @@ -217,8 +217,7 @@ directory to the WebAssembly program. So providing a full path doesn't work:

```
$ wasmtime --dir=$PWD --dir=/tmp demo.wasm test.txt /tmp/somewhere.txt
$ cat /tmp/somewhere.txt
error opening input test.txt: Capabilities insufficient
error opening input test.txt: No such file or directory
```

So, we always have to use `.` to refer to the current directory.
Expand All @@ -228,11 +227,11 @@ out of the sandbox? Let's see:

```
$ wasmtime --dir=. --dir=/tmp demo.wasm test.txt /tmp/../etc/passwd
error opening output /tmp/../etc/passwd: Capabilities insufficient
error opening output /tmp/../etc/passwd: Operation not permitted
```

The sandbox says no. And note that this is the capabilities system saying no
here ("Capabilities insufficient"), rather than Unix access controls
here ("Operation not permitted"), rather than Unix access controls
("Permission denied"). Even if the user running `wasmtime` had write access to
`/etc/passwd`, WASI programs don't have the capability to access files outside
of the directories they've been granted. This is true when resolving symbolic
Expand Down